CVE-2026-82876

HighCVSS 8.2

Published: 31/08/2026(UTC)Updated: 10/09/2026(UTC)Translated: 31/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.09%

0th percentile - higher than 0% of all known CVEs

Summary

Phison PS3111-S11 controller firmware verifies RSA signatures using a public modulus embedded within the firmware image itself rather than anchored in immutable storage. Attackers can generate arbitrary RSA key pairs, sign modified firmware with the private key, embed the matching modulus in the signature segment, and the controller accepts the tampered firmware as valid.

Risk Assessment

Risk of malicious firmware installation, potentially leading to full device compromise and persistent control.

Recommendation

Apply firmware updates provided by the manufacturer and monitor firmware integrity.

Other vulnerabilities in Phison PS3111-S11

CVE-2026-84696High
Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent or defeatable authentication mechanisms. Attackers can bypass the weak CRC-16 based unlock handshake or exploit builds with no VUC lock to read and write controller memory and raw flash, persisting implants across power cycles.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS